Hi,

1. It means you didn't clean deeply. I know it sounds cruel, but that's just how it is. Contact with Hosting Support and analize logs. We don't clean servers from malware!! Our tool cannot replace, for example, Imunify360+ (hosting tool).
2. Your server may not have sites separation, and different infected site could harm your site.
3. You have different backdoor, it can be different extension or hidden file (popular method).
4. You don't have firewall component that could be your last defence guard.

It seems to be fixed. No hacking this night. By the hack some of the layouts of my SP Page Builder pages are broken. It seems that page-specific styling or CSS settings may have been modified. Could you tell me where SP Page Builder stores the CSS and styling settings for individual pages? Are these stored in the Joomla database, for example in the SP Page Builder tables (and so yes, which table?), or are they saved/generated as separate CSS files? What would be the recommended way to restore or repair these page layouts?

They are generated dynamical based on chosen settings, and some CSS are from SPPB itself.

Maybe use SPPB table (prefix_sppagebuilder) from backup, before site was hacked.

Yes, remember to reinstall SPPB component after, and clear Joomla cache etc.